WPF files a FOIA to obtain the DOJ’s annual report of their uses of protected health information

September 26, 2012
This is a request by the World Privacy Forum under the Freedom of Information Act.

Section 3 of Executive Order 13181, To Protect the Privacy of Protected Health Information in Oversight Investigations, states:

(d) On an annual basis, the Department of Justice, in consultation with the Department of Health and Human Services, shall provide to the President of the United States a report that includes the following information:(i) the number of requests made to the Deputy Attorney General for authorization to use protected health information discovered during health oversight activities in a non-health oversight, unrelated investigation;

(ii) the number of requests that were granted as applied for, granted as modified, or denied;
(iii) the agencies that made the applications, and the number of requests made by each agency; and

(iv) the uses for which the protected health information was authorized.

This request is for a copy of every annual report made by the Department of Justice under this provision of Executive Order 13181. We prefer to have the copies in a widely available electronic format, such as a PDF file or a Word document. Having an electronic format will facilitate the posting of the reports on the World Privacy Forum’s website at www.worldprivacyforum.org. We note this is our second request for this report. Our first request was made November 29, 2007. The DOJ responded to our 2007 FOIA by saying the annual report could not be located.

The World Privacy Forum is a non-partisan, non-profit public interest research and consumer education organization. Our focus is on conducting in-depth research and analysis of privacy issues, including issues related to health care.

As a non-profit public interest organization that qualifies as a representative of the news media because of its demonstrated ability to disseminate information to the public, fees for this request should be limited to copying charges. You may visit our World Privacy Forum in the Press Page to find a partial list of articles in which the World Privacy Forum or its researchers are quoted. We also actively disseminate information to the public and the press. A leading example is our report Medical Identity Theft: The Information Crime that Can Kill You, which received extensive attention from the public, press, and policy makers.

We request a waiver of all fees because:

1) Disclosure of the requested information is in the public interest because it is likely to contribute significantly to public understanding of the operations or activities of the government.

The reports in question should illustrate the extent to which the federal government uses individual health records discovered during the course of health oversight activities for unrelated civil, administrative, or criminal investigations of a non-health oversight matter. This was an important enough matter to warrant the issuance of an Executive Order shortly after the HIPAA health privacy rules were finalized by the Clinton Administration. The subject of the requested reports will directly illuminate government activities for which information is otherwise unavailable. As far as we can tell, the reports have not been made available to the public. From a previous FOIA, we suspect the reports may not even exist.

The disclosure is in the public interest because it will show how the government implements its authority to obtain health records for health oversight purposes and then uses the records for other purposes. This is a significant health privacy issue today, and its importance will expand as health records continue to migrate to digital platforms and as law enforcement agencies interface with those data. We note that much attention has been given to Fusion Centers, and that Fusion Centers are collecting and using health care data in some capacity. The DOJ published a document regarding the collection of medical data for Fusion Centers, Health Security: Public Health and Medical Integration into Fusion Centers, July 2011. (Available at http://www.it.ojp.gov/docdownloader.aspx?ddid=1450)

Shedding light on these activities will contribute to understanding of government activities and contribute to increased public understanding of those activities. Public debates on the structure and operations of a health information network are ongoing, and law enforcement use of health records is a significant part of that debate. We do not know whether secondary use of health records for non-health oversight, unrelated investigations is a major or minor activity by law enforcement and other agencies, and the mandated annual reports may be the only source of clear, factual information.

Given the World Privacy Forum’s past record of putting privacy information before the public and the press, there can be no doubt about its expertise in the subject area and its ability to effectively convey information to the public. We refer you to our website’s materials on medical identity theft and other issues at our Medical Identity Theft Resource Page as well as our materials on medical privacy in general at our Medical Privacy Resource Page.

The subject of use of medical records affects every patient in the United States and is of broad public interest.

2) Disclosure of the information is not primarily in the commercial interest of the requester.

The World Privacy Forum is a non-partisan, non-profit public interest research and consumer education organization that has no commercial interests.
Rather than delay processing of this request or disclosure of the requested materials, the World Privacy Forum agrees to pay fees up to $25.00. If the Department intends to charge fees that exceed $25.00, please contact us beforehand so that we can reconsider or adjust the request. If our fee wavier request cannot be granted promptly or is denied, we are likely to be willing to pay fees promptly to obtain the documents and affirmatively defend our status for the assessment/waiver of fees on appeal.

To score is human. Ranking individuals by grades and other performance numbers is as old as human society. Consumer scores — numbers given to individuals to describe or predict their characteristics, habits, or predilections — are a modern day numeric shorthand that ranks, separates, sifts, and otherwise categorizes individuals and also predicts their potential future actions. This new report by Pam Dixon and Robert Gellman explores this issue of predictive scores and privacy.

This Jan. 30, 2014 report discusses a new right to restrict disclosure of health information under the updated HIPAA health privacy rule. The new provision called “Pay Out of Pocket,” also called the “Right to Restrict Disclosure” gives patients the right to request that their health care provider not report or disclose their information to their health plans when they pay for medical services in full. Navigating the new right will take effort and planning for patients to utilize effectively. This substance of this report is about the new patient right to restrict disclosure, and how patients can use it to protect health privacy.

This report focuses on government use of commercial data brokers, the implications for that usage, and what needs to be done to address privacy problems. The government must bring itself fully to heel in the area of privacy. If it is going to outsource its data needs to commercial data brokers, it needs to attach the privacy standards it would have been held to if it had collected the data itself. Outsourcing is not an excuse for evading privacy obligations. Report authors: Bob Gellman and Pam Dixon.